5

Here's the scenario:

Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password.

Instead of changing your password, you then change your account email. Should the password reset links still be valid? Is it a security risk to not invalidate them?

Improve this question
1
  • should you not also only have a single valid password reset link?
    – Richie Frame
    Apr 25, 2018 at 0:22

2 Answers 2

Reset to default
9

I would argue that yes, you should invalidate them. The email change may be because the email account is compromised. And there is no harm in invalidating them, as the user is clearly logged in and can just request another one if they need to.

That being said, it is much more important to send a verification email to the old mail before you allow a change and if the user lost access, send instead an undo link valid for at least 7 days (ideally more). Otherwise, you risk account theft.

Lastly, if you support 2FA, you should not allow resetting both factors using just email.

PS: Also you should not allow changing mail for a period of time after password reset.

Improve this answer
8
  • 3
    So you say the email account may be compromised, but then suggest sending an email change undo link?
    – multithr3at3d
    Apr 24, 2018 at 17:43
  • @multithr3at3d I suggested that only if the owner cannot access the confirmation link. And yes, I think it is better to end up in a stalemate between the attacker and the owner than let the account be stolen entirely in some cases. You can make a more elaborate system if you want to solve this, or just enforce 2FA.
    – Peter Harmann
    Apr 24, 2018 at 17:45
  • 2
    @jdubjdub By writing my last comment, I realized I should add: Also you should not allow changing mail for a period of time after password reset, so that a compromised email can not result in account being taken over entirely.
    – Peter Harmann
    Apr 24, 2018 at 17:53
  • 1
    I would also argue that you should only have one valid password reset link at a time. If a new link is requested, invalidate the old one because they're telling you they didn't get the first one. So who knows where it ended up?
    – nbering
    Apr 24, 2018 at 18:59
  • 1
    I think your last 3 points are extremely important. Everyone uses email as a verification method. Depending on what your site is, you may even want to disable extremely sensitive transactions when something as drastic as an email address change happens. (Financial transactions for instance)
    – Steve Sether
    Apr 24, 2018 at 19:11
2

You shouldn't be able to change your email address if you don't know the password. If you lose both the password and access to the email of record, you're screwed.

Improve this answer
2
  • 1
    yep, we're requiring verification and password to confirm email change already. no way to change email if you don't have access to both emails and password.
    – jdubjdub
    Apr 24, 2018 at 17:46
  • I think that's too extreme - people lose access to particular email addresses all the time. If they do, they'd be locked into the existing password forever.
    – ddyer
    May 29, 2020 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .